Portál AbcLinuxu, 15. července 2025 01:45
iptables -F
a dávám nová pravidla pro vstup, výstup a přeposílání paketů jako ACCEPT a stejně tak i na vzdáleném klientovi. ip_forward = 1
SERVER
mode server tls-server dev tap proto udp port 6277 ifconfig 192.168.100.1 255.255.255.0 ifconfig-pool 192.168.100.2 192.168.100.254 255.255.255.0 client-to-client push "route 192.168.22.0 255.255.255.0 192.168.100.1" # klient posílá pakety pro síť v rozsahu 192.168.22.0/24 přes tunel ca /etc/pki/CA/cacert.pem cert /etc/pki/CA/openvpn_public_key.pem key /etc/pki/CA/openvpn_private_key.pem dh /etc/pki/CA/dh1024.pem log-append /var/log/openvpn status /var/run/openvpn/vpn.status 10 comp-lzo verb 3 keepalive 10 120 duplicate-cnKLIENT
remote 81.30.251.11 port 6277 proto udp tls-client dev tap pull mute 10 client ca /etc/openvpn/cacert.pem cert /etc/openvpn/openvpn_public_key.pem key /etc/openvpn/openvpn_private_key.pem comp-lzo verb 3 pulljinak po připojení tabulka route Klienta
Směrovací tabulka v jádru pro IP Adresát Brána Maska Přízn Metrik Odkaz Užt Rozhraní 192.168.100.0 * 255.255.255.0 U 0 0 0 tap0 192.168.0.0 * 255.255.255.0 U 0 0 0 eth1 link-local * 255.255.0.0 U 0 0 0 eth0 link-local * 255.255.0.0 U 1000 0 0 eth1 default 192.168.0.1 0.0.0.0 UG 0 0 0 eth1 default * 0.0.0.0 U 1000 0 0 eth0
Tady je: Směrovací tabulka v jádru pro IP Adresát Brána Maska Přízn Metrik Odkaz Užt Rozhraní 192.168.100.0 * 255.255.255.0 U 0 0 0 tap0 192.168.22.0 * 255.255.255.0 U 0 0 0 eth0 169.254.0.0 * 255.255.0.0 U 0 0 0 eth0 default 192.168.22.1 0.0.0.0 UG 0 0 0 eth0a Pingy jsou z serveru na vzdáleného klienta:
[root@ferit ~]# ping 192.168.100.2 PING 192.168.100.2 (192.168.100.2) 56(84) bytes of data. From 192.168.100.1 icmp_seq=2 Destination Host Unreachable From 192.168.100.1 icmp_seq=3 Destination Host Unreachable From 192.168.100.1 icmp_seq=4 Destination Host Unreachable From 192.168.100.1 icmp_seq=6 Destination Host Unreachable From 192.168.100.1 icmp_seq=7 Destination Host Unreachable From 192.168.100.1 icmp_seq=8 Destination Host Unreachable --- 192.168.100.2 ping statistics --- 8 packets transmitted, 0 received, +6 errors, 100% packet loss, time 7000ms , pipe 3a z klienta na server (adresa v rámci VPN):
ping 192.168.100.1 PING 192.168.100.1 (192.168.100.1) 56(84) bytes of data. 64 bytes from 192.168.100.1: icmp_seq=1 ttl=64 time=367 ms 64 bytes from 192.168.100.1: icmp_seq=2 ttl=64 time=280 ms 64 bytes from 192.168.100.1: icmp_seq=3 ttl=64 time=327 ms --- 192.168.100.1 ping statistics --- 3 packets transmitted, 3 received, 0% packet loss, time 2002ms rtt min/avg/max/mdev = 280.414/325.018/367.545/35.607 msa ping na server (přes jeho vnitřní adresu za VPN tunelem):
ping 192.168.22.254 PING 192.168.22.254 (192.168.22.254) 56(84) bytes of data. --- 192.168.22.254 ping statistics --- 15 packets transmitted, 0 received, 100% packet loss, time 14010ms
tcpdump
...
na rozhrani hned vidite ten traffic, co chcete, kdyz nevidite, pak je problem :) treba fw atd...
$ sudo tcpdump -i pppoe0 -n -v -ttt icmp tcpdump: listening on pppoe0, link-type PPP_ETHER Jun 03 13:19:45.330194 85.207.203.xxx > 89.250.252.18: icmp: echo request (id:1f2a seq:0) (ttl 255, id 22675, len 84) Jun 03 13:19:45.341576 89.250.252.18 > 85.207.203.xxx: icmp: echo reply (id:1f2a seq:0) (ttl 58, id 64328, len 84)u vas to bude
-i tunX
push "route 192.168.22.0 255.255.255.0 192.168.100.1"
route 192.168.22.0 255.255.255.0 192.168.100.1
Tiskni
Sdílej:
ISSN 1214-1267, (c) 1999-2007 Stickfish s.r.o.